Security and GDPR Compliance

Handling Personal Data According to GDPR

GDPR outlines specific requirements regarding which data must be deleted, when it should be deleted, and how quickly it needs to be processed. This is particularly relevant for personal data that is no longer necessary after a booking. Personal data will be deleted after a configurable number of days, which can be adjusted by a tenant (contractual partner). For support purposes, we recommend retaining this data for at least one month to address any potential issues or customer requests, such as amendments to invoices or damage resolution.

GDPR also specifies which types of data must be retained for longer periods. For example, information related to invoicing or damage claims can be stored for a tenant-configured duration before it is permanently deleted.

Security Measures for Access Codes

GDPR dictates strict protocols for handling security-related data. Access codes are never sent via email or other unsecured channels. Guests receive this information only through a dedicated link that accompanies them throughout their stay. Access codes are displayed exclusively on the dashboard and only after registration has been completed. The display of access codes is further influenced by the logging system.

While the logging system assigns unique codes to individual guests, these codes are presented immediately after the booking is confirmed. A logging system supports a defined validity period, meaning access codes are automatically disabled before the check-in time and after the check-out time.

Access Code Display and Privacy Compliance

Even when an access code is active, its display must comply with GDPR regulations. Access codes should not be immediately visible upon opening a webpage. For instance, a guest could be at an airport or on public transport where others might inadvertently view their phone screen. Instead, the access code is hidden by default, and a "Show Access Code" button is provided. This allows the guest to decide when and where it is safe to view the code. Only when the guest clicks the "Show Access Code" button will the code be displayed on their screen upon their explicit request.